Reverse Proxy to Wazuh

[cyber...@gmail.com]

Hello,

I have two instances of Wazuh running. The first uses ES 7.9.3 and I have no issues with reverse proxy. The second uses opendistro for elasticsearch 1.11.0.0-1 and that is the one that is challenging. 

I get 500 errors, a big red banner, or just spinning. If I bypass the proxy the page loads. An interesting aspect is that if I'm persistent it will eventually load, so  I am assuming this is something to do with caching. But I haven't been able to get it right.

I am using Nginx and the relevant config looks like this:

server {

listen 443 ssl http2;

server_name w4ws.domain.com;

client_max_body_size 50M;

include snippets/restrict.conf;

server_tokens off;

access_log /var/log/nginx/wazuh-error.log;

access_log /var/log/nginx/wazuh-access.log;

expires -1;

location / {

proxy_pass https://192.168.152.152:5601;

        proxy_ssl_verify               off;

proxy_buffer_size                128k;

proxy_buffers                4 256k;

proxy_busy_buffers_size 256k;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Scheme $scheme;

proxy_set_header X-Forwarded-Proto https;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

include conf.d/security.conf;

}

Any insight is appreciated.

Thanks.

[cyber...@gmail.com]

I resolved this by switching to haproxy.